Modern enterprise systems, e.g., enterprise resource planning (ERP) systems, customer relationship management (CRM) systems, enforce a variety of different and complex security policies. Moreover, more and more enterprises operate in regulated markets and, thus, need to prove that their information technology (IT) systems comply with applicable compliance regulations.
The compliance regulations can include complex security and compliance policies that change frequently. This can result in frequent, unintentional violations of policies, e.g., users previously permitted to access a resource are now not permitted to access the resource due to a policy change. As a result, administrators and/or auditors have to dig through numerous logged accesses for incidents of policy violations, and filter out unintentional incidents caused by recent changes in security policies and inaccurate, or outdated policies.